CVE-2025-43913 Overview
CVE-2025-43913 is a Use of a Broken or Risky Cryptographic Algorithm vulnerability [CWE-327] affecting Dell PowerProtect Data Domain systems running Data Domain Operating System (DD OS). The flaw resides in the DDOS cryptographic implementation and permits an unauthenticated remote attacker to obtain sensitive information. Attackers can leverage the weakness to conduct phishing attacks that trick users into disclosing sensitive data. Dell disclosed the issue in security advisory DSA-2025-333 covering multiple PowerProtect Data Domain vulnerabilities.
Critical Impact
An unauthenticated remote attacker can exploit weak cryptography in DD OS to disclose sensitive information and support phishing operations against system users.
Affected Products
- Dell PowerProtect Data Domain DD OS Feature Release versions 7.7.1.0 through 8.3.0.15
- Dell PowerProtect Data Domain DD OS LTS2025 release version 8.3.1.0 and LTS2024 releases 7.13.1.0 through 7.13.1.30
- Dell PowerProtect Data Domain DD OS LTS2023 release versions 7.10.1.0 through 7.10.1.60
Discovery Timeline
- 2025-10-07 - CVE-2025-43913 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-43913
Vulnerability Analysis
The vulnerability stems from the use of a broken or risky cryptographic algorithm within DD OS. Weak algorithms produce ciphertext, signatures, or session material that attackers can analyze or manipulate without prior authentication. Dell's advisory identifies the flaw as network-reachable and exploitable without credentials, though successful exploitation requires user interaction. Successful abuse leads to information disclosure and enables downstream phishing that harvests sensitive data from operators or administrators.
Dell PowerProtect Data Domain appliances serve as backup and recovery infrastructure across enterprise environments. Cryptographic weaknesses in this class of system expose backup metadata, session content, and trust relationships that adjacent systems rely on. The advisory (DSA-2025-333) documents this issue alongside other vulnerabilities patched in the same release cycle.
Root Cause
The root cause is the selection or continued support of a cryptographic primitive that no longer meets modern strength requirements. This class of issue includes deprecated hash functions, small key sizes, insecure cipher modes, or protocols that lack forward secrecy. The specific algorithm in use has not been detailed by Dell in the public advisory beyond the [CWE-327] classification.
Attack Vector
The attack vector is network-based and requires no privileges. An attacker interacts with the DD OS interface remotely and induces a user to perform an action that exposes protected data. The information gathered can then be repurposed for phishing campaigns targeting administrators of the affected appliance. Refer to the Dell Security Update Advisory for vendor-supplied technical context.
Detection Methods for CVE-2025-43913
Indicators of Compromise
- Unexpected TLS or cryptographic handshake negotiations on DD OS management interfaces using deprecated ciphers or protocol versions.
- Anomalous administrator logins following phishing attempts referencing PowerProtect Data Domain systems.
- Repeated unauthenticated connections from external sources to DD OS network services.
Detection Strategies
- Inventory DD OS instances and compare running versions against the affected ranges listed in DSA-2025-333.
- Inspect network traffic to DD OS management endpoints for use of weak ciphers, legacy TLS versions, or malformed cryptographic exchanges.
- Correlate DD OS access logs with email security telemetry to identify phishing lures targeting backup administrators.
Monitoring Recommendations
- Forward DD OS audit and authentication logs to a centralized SIEM for retention and correlation.
- Alert on configuration changes to cryptographic settings, certificate stores, or administrator accounts on Data Domain appliances.
- Monitor egress traffic from DD OS systems for connections to unfamiliar destinations that may indicate data exfiltration.
How to Mitigate CVE-2025-43913
Immediate Actions Required
- Apply the DD OS updates identified in Dell advisory DSA-2025-333 for each affected release branch.
- Restrict network access to DD OS management interfaces to trusted administrative networks only.
- Review recent administrator activity and rotate credentials for accounts that may have been exposed to phishing.
Patch Information
Dell has released fixed versions across the Feature Release, LTS2025, LTS2024, and LTS2023 branches. Consult the Dell Security Update Advisory for the specific fixed version corresponding to each affected release track and apply the appropriate DD OS upgrade.
Workarounds
- Segment DD OS management interfaces behind a jump host or VPN to limit unauthenticated network exposure.
- Disable deprecated protocols and weak cipher suites on network intermediaries protecting the appliance where configuration permits.
- Deliver targeted phishing awareness training to backup and storage administrators who interact with Data Domain systems.
# Configuration example
# Verify running DD OS version and plan upgrade per DSA-2025-333
system show version
# Restrict management access using host-based access controls
adminaccess add ssh <trusted-admin-cidr>
adminaccess add http <trusted-admin-cidr>
# Disable legacy protocols where supported by the platform
adminaccess disable telnet
adminaccess disable ftp
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
